Privacy Shouldn't Be an Afterthought
Most productivity apps collect your data first and think about privacy later. We built Vyneron the other way around — privacy controls are part of the core architecture, not a checkbox added before launch.
Here's exactly what we do with your data, how you can control it, and what happens when you want to leave.
Full Data Export
Under GDPR (Article 20) and KVKK (Article 11), you have the right to receive all your personal data in a portable format.
In Vyneron, go to Settings → Account and export your data. The GET /api/users/me/export endpoint returns everything — your profile, tasks, notes, routines, chat history, and settings — as a single JSON file. No support tickets, no waiting period, no "we'll get back to you in 30 days."
This endpoint is rate-limited to 3 requests per hour to prevent abuse, but there's no restriction on how often you can export over time.
Account Deletion
When you delete your account:
- Your account enters a 15-day grace period (soft delete) — you can recover it if you change your mind
- After 15 days, all your data is permanently removed
- Team members' deletion requests are routed to the workspace owner for approval
- Workspace owners can delete immediately
No dark patterns, no "are you really sure?" loops. Settings → Account → Delete.
Your AI Data Stays Yours
This is where Vyneron is fundamentally different from most AI-powered apps.
With BYOK (Bring Your Own Key)
When you connect your own API key (Google Gemini, OpenAI, or Groq), your messages go directly from Vyneron to your chosen provider. We never see, store, or process the AI conversation content. The data flow is:
You → Vyneron (routing only) → Your AI Provider
Vyneron acts as a router — it sends your message to your provider and returns the response. The actual AI processing happens on your provider's infrastructure, under your provider's terms.
With System AI
When using Vyneron's built-in AI (during the free trial or on paid plans), your messages are processed through our managed provider chain. Chat messages are stored in your account for conversation history, and you can delete them at any time.
Encrypted API Keys
If you use BYOK, your API key is encrypted before it ever touches our database:
- Encryption: Fernet (AES-128) with PBKDF2-derived keys
- At rest: Only the encrypted version is stored — plaintext never hits the database
- In memory: Decrypted only during an active AI call, then discarded
- In the UI: Only the first and last 4 characters are shown (e.g.,
AIza...8xQ2) - In logs: Never written — not in application logs, not in error reports
- Access control: Only workspace owners and admins can view or change the key
Security Headers
Every request to Vyneron is served with a full set of security headers:
| Header | What It Does | |--------|-------------| | Content-Security-Policy | Blocks unauthorized scripts from running | | Strict-Transport-Security | Forces HTTPS with 2-year cache + preload | | X-Frame-Options: DENY | Prevents clickjacking by blocking iframe embedding | | X-Content-Type-Options | Stops browsers from MIME-sniffing responses | | Referrer-Policy | Limits what URL information is shared with other sites | | Permissions-Policy | Blocks access to camera, microphone, and geolocation |
These aren't optional extras — they're enforced on every response from both vyneron.com and app.vyneron.com.
Rate Limiting
All sensitive endpoints are rate-limited to prevent brute-force attacks:
| Action | Limit | |--------|-------| | Login attempts | 5 per minute | | Registration | 5 per minute | | AI chat messages | 10 per minute | | Data export | 3 per hour | | Token refresh | 10 per minute |
If you hit a limit, you get a clear 429 Too Many Requests response — not a silent failure.
What We Don't Do
- No tracking pixels in emails or the app (Vercel Analytics is on the landing page only, anonymized)
- No selling data to third parties — ever
- No AI training on your data — your tasks, notes, and conversations are yours
- No hidden data retention — when you delete something, it's deleted
- No mandatory cookies beyond a single locale preference cookie (
vyneron_locale)
KVKK Compliance (Turkey)
Vyneron complies with Turkey's KVKK (Kişisel Verilerin Korunması Kanunu), which mirrors GDPR in most respects:
- Açık rıza: Data processing requires explicit consent
- Veri taşınabilirliği: Full data export via API
- Silme hakkı: Account deletion with grace period
- Veri güvenliği: AES-128 encryption, rate limiting, security headers
- Veri sorumlusu: Clearly identified in the privacy policy
Open by Design
We don't ask you to trust us blindly. Here's what you can verify yourself:
- Data export: Run it right now and see exactly what we store
- Security headers: Open your browser's developer tools on
app.vyneron.comand check the response headers - BYOK data flow: Connect your own API key and check your provider's usage dashboard — you'll see the calls coming directly from Vyneron's server, with your key
- Privacy policy: Available at vyneron.com/legal/privacy-policy in 6 languages
The Bottom Line
Your data is yours. You can export it, delete it, or bring your own AI key so we never see your conversations. That's not a marketing promise — it's how the system is built.